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CLAIMS 



1. A security intrusion mitigation method comprising: 

utilizing network spanning tree configuration information to determine an 
5 action for mitigating diffusion of intrusive attacks, wherein said spanning tree 
information includes an indication of an internal diffusion risks; and 

performing said action for mitigating diffusion of intrusive attacks 
automatically, wherein said action for mitigating includes compensation for functional 
support of prioritized applications. 

10 

2. A security intrusion mitigation method of Claim 1 further comprising utilizing 
said internal diffusion risk values to determine components forming a path in said 
spanning tree configuration with a highest cumulative diffusion impact risk. 



15 3. A security intrusion mitigation method of Claim 1 wherein said internal 
diffusion risk includes an asset value factor. 



4. A security intrusion mitigation method of Claim 3 wherein said asset value 
corresponds to an economic impact of a disruption to functionality provided by a 

20 network component. 

5. A security intrusion mitigation method of Claim 1 wherein said internal 
diffusion risk includes an exposure rating factor. 
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6. A security intrusion mitigation method of Claim 5 wherein said exposure rating 
defines a threshold value corresponding to connectivity of a network component with 
other network components. 

5 7. A security intrusion mitigation method of Claim 5 wherein said network 

component is assigned an exposure rating value based upon a connectivity distance 
from a root node. 

8. A security intrusion mitigation method of Claim 5 wherein said action for 

10 mitigating diffusion of intrusive attacks is implemented in accordance with a highest 
risk algorithm. 

9. A security intrusion mitigation method of Claim 5 wherein said network 
spanning tree configuration information includes information associated with 

15 components included in a utility data center and said mitigation action is implemented 
in said utility data center. 

10. A security intrusion mitigation system comprising: 
a means for communicating information; 

20 a means for processing said information including instructions for determining 

a highest risk path and automatically mitigating an attack spread to components 
included in said highest risk path; and 

a means for storing said information, including instructions determining a 
highest risk path and automatically mitigating an attack spread to components 

25 included in said highest risk path. 
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11. A security intrusion mitigation system of claim 10 wherein said instructions 
include security management instructions implemented on a network application 
management platform. 

5 12. A security intrusion mitigation system of claim 10 further comprising a means 
for interfacing with a network application management platform. 

13. A security intrusion mitigation system of claim 10 wherein said instructions 
include attack spread risk determination instructions. 

10 

14. A security intrusion mitigation system of claim 10 further comprising a means 
for centrally controlling a utility data center operations. 

15. A computer usable storage medium having computer readable program code 
15 embodied therein for causing a computer system to implement security intrusion 

mitigation instructions comprising: 

a component risk determination module for determining a risk of an attack 
spreading from a first component to a second component included in a network; and 
an attack spreading response module for responding to said risk of an attack 
20 spreading from a first component to a second component included in said network. 

16. A computer usable storage medium of Claim 15 wherein said risk is biased 
based upon an economic value of functions said second component performs. 

25 17. A computer usable storage medium of Claim 15 said risk is biased based upon 
connectivity of said second component to said first component in said network. 
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18. A computer usable storage medium of Claim 17 wherein said response includes 
reducing traffic communication to said second component. 

19. A computer usable storage medium of Claim 15 wherein said response includes 
turning off an interface of said second component to said network. 

20. A computer readable medium of Claim 19 wherein said response is performed 
in accordance with an highest risk analysis. 
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